Fix origin validation bypass in postMessage trust checks (#4724) ## Description Fixes a security issue reported by a customer where `postMessage` origin/referrer validation could be bypassed using spoofed or lookalike hostnames, potentially allowing untrusted windows to send messages (including block bindings that get executed as code) to Builder-rendered pages. Specifically: - **`packages/core/src/builder.class.ts`**: `Builder.isTrustedHostForEvent` previously parsed the origin without strictly validating the protocol/format, and `Builder.isEditing` used an unanchored regex (`/builder\.io|localhost:1234/`) against `document.referrer`, which would match spoofed hostnames like `evil-builder.io.attacker.com` or `notlocalhost:1234x`. This has been fixed by: - Requiring the origin to match `^https?:\/\//i` before parsing. - Validating the parsed protocol is `http:`/`https:` and the hostname is trusted via `Builder.isTrustedHost`. - Replacing the unanchored regex check in `isEditing` with a call to `Builder.isTrustedHostForEvent`, reusing the same validated logic. - **`packages/react/src/components/builder-block.component.tsx`**: `BuilderBlock.onWindowMessage` did not validate the message origin at all, unlike `BuilderContent.onWindowMessage`. Added an origin check using `Builder.isTrustedHostForEvent(event)` at the top of the handler, returning early if the origin isn't trusted, matching the existing pattern used by `BuilderContent`. - **`packages/sdks/src/functions/is-from-trusted-host.ts`**: `isFromTrustedHost` used `startsWith('http')`/`startsWith('https')` checks and did not guard against malformed URLs throwing during `new URL(...)`. Updated to safely parse the URL in a try/catch, return `false` on parse failure, and explicitly validate the protocol is `http:` or `https:` before checking the hostname against the trusted hosts list. This applies the same fix to the Gen2 SDKs. ### Tests - Added/updated tests in `packages/core/src/builder.class.test.ts`, `packages/react/test/builder-block.test.tsx` (new), and `packages/sdks/src/functions/is-from-trusted-host.test.ts` covering spoofed hostnames (e.g. `evil-builder.io.attacker.com`, `notlocalhost:1234x`), non-HTTP origins (e.g. `javascript://builder.io`), the literal string `"null"`, and non-URL strings — asserting these are all correctly rejected as untrusted. **JIRA** https://builder-io.atlassian.net/browse/ENG-13357 ---

--- To clone this PR locally use the [Github CLI](https://cli.github.com/) with command `gh pr checkout 4724` You can tag me at @builderio for anything you want me to fix or change --- > [!NOTE] > **High Risk** > Security fix for editor postMessage handling and code-binding updates; incorrect validation could break legitimate editing or leave XSS vectors open. > > **Overview** > Closes a **postMessage origin bypass** where spoofed hostnames or malformed origins could be treated as trusted, allowing untrusted pages to send editor messages (including `builder.patchUpdates` that apply bindings executed as code). > > **`Builder.isTrustedHostForEvent`** now requires `^https?://`, parses the origin in a try/catch, enforces `http:`/`https:` protocol, and checks the hostname with **`Builder.isTrustedHost`** (exact match, not substring). **`Builder.isEditing`** drops the unanchored `/builder\.io|localhost:1234/` referrer regex in favor of the same helper. > > **`BuilderBlock.onWindowMessage`** adds an early **`isTrustedHostForEvent`** guard (aligned with other editor listeners). Gen2 **`isFromTrustedHost`** mirrors the same parse/protocol/hostname rules. > > Tests cover lookalike domains, non-HTTP schemes, and invalid origins; a changeset patches all affected SDK packages. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
e7f5de7509ad1c674bbb0279c1e95257d2cf64d9. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).} --------- Co-authored-by: Builder.io